Hi *,
I am struggling with a TaintTracking query using the isSanitizer() to detect when a tainted data is used in a comparison operation.
I have the following code:

void get_check_data( int* p ) {
    copy_from_user(p, src, len);
    if(*p < 0 ) *p = 0; // I want to cover this scenario
}

void f1(){
    int* p;
    copy_from_user(p, src, len);
    if( *p < 0 ) *p = 0;
    mysink(*p);
}

void f2(){
    int p;
    get_check_data(&p);
    mysink(p);
}

void main(){
    f1();
    f2();
}

I wrote the query to find the flow from source (copy_from_user) to sink (mysink) and it works. Actually I am struggling with the isSanitizer() because I want to filter out those expressions where a tainted node is used in a comparison op, I managed to achieve it for f1() but not for f2()
The query looks like the following:

class CopyFromUserSource extends DataFlow::Node { 
    CopyFromUserSource() {
        exists(FunctionCall fc|
            fc.getTarget().getName() = "copy_from_user"
            and this.asDefiningArgument() = fc.getArgument(0)
        )
    }
} 
// this is called in isSanitizer()
// a tainted node guarded by a lte condition
predicate isASanitizer(Data::Flow node){
    exists( IfStmt aif, LTExpr lte|
        node.asExpr().(PointerDereferenceExpr).getOperand().(VariableAccess).getTarget().getAnAccess() = aif.getControllingExpr().getAChild*()
        and aif.getASuccessor+() = node.asExpr()
        and not ( node.asExpr() = aif.getControllingExpr().getAChild*() )
        and lte = aif.getControllingExpr().getAChild*().(RelationalOperation)
    )    
    or exists( IfStmt aif, LTExpr lte|
        node.asExpr().(VariableAccess).getTarget().getAnAccess() = aif.getControllingExpr().getAChild*()
        and aif.getASuccessor+() = node.asExpr()
        and not ( node.asExpr() = aif.getControllingExpr().getAChild*() )
        and lte = aif.getControllingExpr().getAChild*().(RelationalOperation)
    )
}

however, this version is not working for f2().
I used hasPartialFlow() to debug tainting propagation and I noticed that seems the taint does not reach to expression if(*p < 0 ) *p = 0; in get_check_data().
To my understanding, that expression should be a tainted node because it is an access to tainted data. is that correct? what am I missing?

thanks

ps: thanks for bringing us codeQL